Xscale Lancamentos LTDA
Data Classification and Encryption Policy
Classes
| Class | Examples | Handling |
|---|---|---|
| Restricted | App secret, OAuth access/refresh tokens, account passwords | Encrypted at rest, never in source control or logs, owner-only access |
| Confidential | Affiliate order and commission reports, account analytics | Kept on the operator workstation only, used for internal reporting |
| Internal | Product lists, scripts, content drafts | Company systems only |
| Public | Website, published videos | No restriction |
Personal data
Xscale does not collect or store TikTok buyers' personal data (names, addresses, phone numbers). If an API response ever contains it, it is not persisted.
Encryption
- In transit: all traffic uses HTTPS with TLS 1.2 or higher (TikTok Open API, OAuth endpoints, our website).
- At rest: OAuth tokens are encrypted with AES-256-GCM using a key stored separately from the token file; tampered files are rejected.
Retention
Restricted data is deleted when no longer needed; reports are kept for up to 5 years for tax purposes, then deleted.